Suboptimal Merlin dependency in 1.0.0-pre.3 breaks imports with batch feature

[huitseeker]

Steps to reproduce

• create an initial project (cargo init) in an empty directory
• append the following line to the Cargo.toml:
  ed25519-dalek = { version = "1.0.0-pre.3", features = ["batch"] }
• run cargo check
• witness the following error:
  https://gist.github.com/e8b3b975b8d4350d1f65620ed6aff650
• run cargo tree, witness the following resolution (note merlin):
  https://gist.github.com/2af621421014abdb3df3b40859f04612

Cause

The batch feature activates both merlin and rand, and though the entire dalek suite recently updated its libraries to support a recent flavor of rand, the particular dependency set for merlin currently depends on the source-incompatible rand 0.4.2:

huitseeker@pegasus➜huitseeker/tmp/ed25519-dalek(master✗)» git rev-parse HEAD                                                                                                                                                                                          [15:46:06]
36a51acbf0ca2c10d974940182c0ff63f530c9d3
huitseeker@pegasus➜huitseeker/tmp/ed25519-dalek(master✗)» grep merlin Cargo.toml                                                                                                                                                                                      [15:46:21]
merlin = { version = "1", default-features = false, optional = true, git = "https://github.com/isislovecruft/merlin", branch = "develop" }

Since the demo repository above requires ed25519-dalek by version, the version requirement "wins" against the "conflicting" git attribute, making isislovecruft/merlin@c483190 irrelevant and leading to a resolution of crates-io's merlin 1.3.0.

Fix

The update of the rand dependencies to a version (much) posterior to 0.5 is already in merlin, all that's left is to update the merlin dependency to match.

[huitseeker]

This should be closed by #127 as soon as a corresponding release is issued.

[tarcieri]

We're encountering this as well: https://github.com/OLSF/libra/pull/103/checks?check_run_id=825672145

[huitseeker]

@tarcieri this link is not public I'm afraid.

Until eddsa 1.0.0-pre4 is released, a workaround is to add this to the root Cargo.toml:

[patch.crates-io]
ed25519-dalek = { git = "http://github.com/dalek-cryptography/ed25519-dalek" }

which should not change the ed25519 version fundamentally (the default branch for ed25519 is its release branch), but will force cargo resolution for ed25519 to follow the "git" flavors over the conflicting version number, thereby depending on the particular patched ("gitted") merlin that "works" with the "batch" feature.

[isislovecruft]

Thanks! I'm about to release a 1.0.0-pre.4 which should resolve this, but feel free to reopen if not.